Privacy policy

Last updated: 7 November 2026

This policy explains what personal information Mandarin Shadow (跟读), French Shadow and Spanish Shadow (together, "we", "us" and "the Service") collect, why we collect it, how we use, store and share it, and the choices you have. The Service is a language-learning project: we make shadowing videos, podcast episodes, pictures and graded readers, publish them to our own accounts on YouTube, Instagram, TikTok, Facebook, Threads and podcast apps and on this website, and answer the comments and messages people send us. We are an independent creator based in Australia. For any question or request about your information, use the contact details in section 14.

1. Who this policy covers

Website visitors and podcast listeners: people who open this website or play or download an episode.
Viewers and followers: people who watch, like, comment on, share or message us on YouTube, Instagram, TikTok, Facebook or Threads.
Account owners: people who connect a social media account to the app so that it can publish to that account. At present this is only the owner of the Service, who connects the Service's own channels. The Service does not offer sign-up or accounts to the public.

2. Information we collect

2.1 Information you give us

Comments, replies, direct messages and Story replies you send us on the platforms above, including your public username or display name, the text of your message and when you sent it. If you tell us a level, a type of video or an idea you would like, we note it so that we can plan future videos.
Messages to our contact address, including your email address and whatever you choose to tell us.
Newsletter sign-ups: if you subscribe to one of our weekly newsletters, your email address, the newsletter, where you signed up, the consent statement you agreed to and when, and a hashed (scrambled) form of your IP address as a record of that consent. We use them only to send the newsletter and any free download you asked for. Every email has an unsubscribe link that works immediately, and the link's page lets you delete this data at any time (/newsletter).

2.2 Information collected automatically

Website and podcast requests: our hosting provider (Vercel) keeps ordinary server logs of requests, such as the IP address, browser or app type (user agent), the page or file requested, the time and an approximate country derived from the IP address.
Podcast download counts: so that we can tell how many people listen, each episode download is recorded with the episode, the date, the listening app (for example Apple Podcasts or Spotify), the country and an anonymous listener code. The code is a salted one-way hash of the IP address and user agent. We do not store the IP address itself with these counts and cannot turn the code back into an address.
Browser storage: your browser may remember which videos you opened. This stays on your device. The website sets no advertising, tracking or analytics cookies.
Platform statistics: YouTube, Instagram, TikTok, Facebook and Threads give us aggregate figures about our own posts (views, likes, comments, shares, saves, reach, watch time, follower counts, the hours our followers are online and, on YouTube, how long viewers watch). These figures do not identify individual viewers.

2.3 Social media account connection data (account owner only)

When the owner connects one of the Service's own accounts, we receive and store an access token (and a refresh token where the platform issues one), the account's identifier, username and display name, and the permissions that were granted. Tokens are stored encrypted (AES-256-GCM). We use them only to publish content to that account, to read that account's own statistics, comments and messages, and to answer them. Section 5 gives the details by platform.

2.4 Information we do not collect

We do not ask for or collect payment details, government identifiers, precise location, contacts, health information or other sensitive information. We do not knowingly collect information from children under 13 (section 11). We do not sell personal information and we do not use it for advertising or to build advertising profiles.

3. How we use information

Purpose	Information used
Publishing our videos, podcast episodes and posts to our own accounts	Account connection data (account owner only)
Reading and answering comments, Story replies and direct messages sent to our accounts	Your public username, your message and the post it was on
Planning what to make next (levels, video types and ideas people ask for)	The level, video type or idea you mentioned, with your username and the post it was on
Measuring how our content performs and improving it	Aggregate platform statistics and podcast download counts
Running, securing and fixing the website and app, and preventing abuse	Server logs and request information
Answering your questions and requests, and complying with the law	Your message and contact details

Where the law requires a legal basis (for example in the European Economic Area and the United Kingdom), we rely on our legitimate interests in running and improving a free educational service and in replying to the people who contact us, on the account owner's consent when connecting an account, and on legal obligation where we must keep or disclose information.

4. Automated processing and AI

Our stories, pictures, narration, podcast scripts and replies are generated with artificial intelligence services that we reach through the Vercel AI Gateway, which routes requests to model providers such as Anthropic and Google. To write a reply to a comment or message, the text of that comment or message, the username it came from and information about the post it was on are sent to an AI model. We do not send passwords, access tokens or email addresses to these services. Replies are posted from our own account and are visible to the same people who can see the original comment; we can review or delete them at any time. AI replies can be wrong, so please do not rely on them for advice.

5. Data from the social media platforms we use

5.1 TikTok

If the owner connects a TikTok account through TikTok Login Kit, we request exactly four permissions (scopes): user.info.basic (the account's open id, display name and avatar, shown in the studio so the owner can see which account is connected), user.info.stats (the account's follower, following, like and video counts, shown only to the owner in the studio and in the owner's engagement reports), video.list (the account's own recent videos with their titles, covers and view, like, comment and share counts, shown only to the owner in the studio and in the owner's engagement reports) and video.upload (to send a video the owner chooses, only when the owner clicks Send to TikTok, to that account's TikTok inbox as a draft the owner reviews, edits and posts in the TikTok app). We store the access and refresh tokens encrypted, together with the open id and display name, and keep the counts in the owner's private engagement records. We use this information only to send the Service's own videos to the Service's own TikTok account as drafts, to check whether a draft arrived and to show the owner how that account and its videos are doing. We do not read other people's videos, direct messages or followers, we do not share TikTok data with third parties and we do not use it for advertising. You can disconnect at any time in the app's Settings (which revokes the token with TikTok and deletes it) or in TikTok under Settings and privacy, Security and permissions, Apps and services. Your use of TikTok is also governed by TikTok's Terms of Service and TikTok's Privacy Policy.

5.2 Google and YouTube

When the owner connects a YouTube channel, the app asks Google for permission to:

upload videos to the channel (youtube.upload),
read the channel's name and the processing status of uploaded videos (youtube.readonly),
create playlists, add videos to them and post and answer comments on the channel's videos (youtube and youtube.force-ssl),
read the channel's own viewing and watch-time statistics (yt-analytics.readonly).

We store only an encrypted OAuth refresh token and the channel name, and the comments on the channel's videos that we read and reply to (section 2.1). We do not store or share other YouTube or Google account data and we never use it for advertising. The Service's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. By using YouTube you agree to the YouTube Terms of Service; see also the Google Privacy Policy. You can remove access at any time in Settings (Disconnect revokes the token at Google) or at myaccount.google.com/permissions.

5.3 Instagram, Facebook and Threads (Meta)

When the owner connects an Instagram professional account, a Facebook Page or a Threads profile, we store an encrypted access token and the account's identifier and username, and use them to publish Reels, posts, Stories and videos, to read the account's own insights (views, reach, likes, shares, saves, follower counts and when followers are online), and to read and answer comments, Story replies and direct messages sent to that account (within the 24-hour reply window Instagram allows). We do not read other people's accounts. Your use of these services is governed by Instagram's Privacy Policy and Meta's Privacy Policy. Access can be removed at any time in the app's Settings or in your Meta account settings under Apps and websites.

5.4 Podcast apps

Our podcast feeds are public and are read by podcast apps and directories such as Apple Podcasts and Spotify. We do not receive your account or listening history from them; we only see the request counts described in section 2.2.

6. Who we share information with

We do not sell or rent personal information. We share it only with:

Service providers that run the Service for us, under their own terms and privacy policies: Vercel (hosting, file and database storage and the AI Gateway), the AI model providers reached through it, and the managed database that stores our records.
The platforms themselves (TikTok, Google and YouTube, Meta, podcast directories), because that is where we publish. Anything we post is public to everyone who can see that account.
Authorities and professional advisers, where the law requires it, to protect our rights, safety and property, or to investigate abuse.
A successor, if the project is ever transferred, on the same terms as this policy.

7. Where information is stored and international transfers

Our providers operate data centres in several countries, including the United States, so your information can be processed outside the country where you live. Where the law requires it, we rely on the safeguards our providers use for international transfers, such as standard contractual clauses.

8. How long we keep information

Account connection tokens: until the account is disconnected, then deleted.
Comments, messages and the replies we sent, and the level, type and idea notes taken from them: for as long as they are useful for running and improving the Service, and deleted on request.
Podcast download counts: kept as anonymous statistics.
Server logs: kept by our hosting provider for the period its service provides.
Videos and pictures we make: stored until we delete them. They do not contain personal information about viewers.
Messages to our contact address: for as long as needed to answer you and keep a record of the request.

9. Security

Tokens are encrypted at rest, access to the app's management tools requires a secret key held by the owner, connections use HTTPS and we limit access to what the Service needs. No system is perfectly secure; if a breach affects your information we will notify you and the regulator where the law requires.

10. Your choices and rights

Depending on where you live (for example under the Australian Privacy Act 1988 and the Australian Privacy Principles, the EU and UK GDPR, or US state laws such as the California Consumer Privacy Act), you may have the right to ask us what we hold about you, to correct it, to delete it, to restrict or object to its use, to receive a copy and to withdraw consent. We do not sell or share personal information for cross-context behavioural advertising. To exercise a right, contact us below; we will verify the request and respond within the time the law requires (generally within 30 days). You can delete your own comments on the platforms at any time, and we remove our replies and records on request. If you are not satisfied, you can complain to your data protection authority, such as the Office of the Australian Information Commissioner (oaic.gov.au). To stop us answering your comments or messages, tell us in a message and we will stop and delete our records of it.

11. Children

The Service is for learners of all ages but is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us and we will delete it. Our videos are not declared "made for kids" on YouTube.

12. Third-party websites

Our videos, posts and pages link to other sites and platforms. We are not responsible for their content or privacy practices; please read their policies.

13. Changes to this policy

We may update this policy as the Service changes. The date at the top shows when it was last updated, and material changes will be shown on this page.

14. Contact

Questions, access, correction and deletion requests, or complaints about privacy: Gatsbytdfitzgerald@gmail.com. Please include the platform and username you used so that we can find your information. Our terms of use are at /terms.